The continued growth of telecommunication networks has led to the proliferation of communication devices that are used for the transfer of both voice and data. Personal Digital Assistants (PDAs) and smart-phones are examples of wireless communication devices that enable users to communicate via voice communications, electronic mail (e-mail), Short Message Service (SMS) messages as well as instant messaging. Additionally, many of these devices also include Web browsers and other applications to provide the users with information and access to remote data.
Due to their portability and ever-increasing functionality, wireless communication devices are becoming a necessity in today's business environment. Conducting business on the Internet is often efficient and cost effective, particularly when products and services can be distributed electronically.
However, as more people have access to the network and more data becomes available on the network, the risk of the wrong people accessing sensitive data increases. Accordingly, it is desirable for many network administrators to limit the devices that can access their network. One mechanism for limiting such access is the use of device certificates.
A device certificate is defined as a public key certificate or an attribute certificate tying the identity of a device to its attributes. An example of the use of digital certificates is the Device Certificate Service provided by VeriSign®. The VeriSign® Device Certificate Service embeds X.509 certificates into hardware devices, which allows service providers to perform strong authentication of their devices. Device manufacturers order certificates in bulk by providing a list of Media Access Control (MAC) addresses or unique device identifiers for the certificates. The issued certificates are returned to the manufacturers, who can then incorporate the process of injecting the certificates into the target devices as part of its overall device manufacturing process.
However, the process of assigning digital certificates during manufacture places an unnecessary burden on the manufacturing process. Further, it limits the digital certificate to a single certifying authority, regardless of the device's purchaser.
U.S. patent application Ser. No. 11/002,315 filed by Tet Hin Yeap et al and titled “System and Method for Access Control” teaches a system for restricting access based on device certificates. In order to assign a certificate to a device, Yeap teaches a system administrator transmitting an email request. The email includes unique identifiers of both the device and an access server. Both identifiers are used to generate a certificate, which is transmitted to the device via an email.
However, the use of the access server identifier ties the device to a single access server. Further, the method requires an email from a system administrator to initiate the certificate. For application in less technically sophisticated companies, such a step would provide an unnecessary burden on the user.
Lastly, in a document titled “Step-by-Step Guide to Deploying Windows Mobile-based Devices with Microsoft Exchange Server 2003 SP2: Appendix A. Deploying Exchange ActiveSync with Certificate-Based Authentication” a method for certificate enrolment configuration is taught. The document teaches a system administrator configuring an Extensible Markup Language (XML) script for device certificate enrolment. The XML script is uploaded to Active Directory using Microsoft Visual Basic Scripting Edition (VBScript). Active Directory is a Microsoft® directory service provided by a network server that provides means to manage identities and relationships that make up a network environment. Accordingly, when a user “cradles” a device, it connects to a corporate network via software on the user's computer. At this point, the XML script created by the administrator is delivered to the device and the certificate enrolment can begin.
However, similar to the previously described solution, the solution presented by this document is difficult to implement. Further, it requires that the device be able to communicate with a server via a cradle arrangement. Such a set-up precludes wireless certificate registration.
Accordingly, there is a need for a method of provisioning device certificates that overcomes the limitations of the prior art.